docker-build-images.yml

name: Build Docker images

on:
  workflow_call:
    inputs:
      runs-on:
        description: |
          JSON array of runner(s) to use.
          See https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job.
        type: string
        default: '["ubuntu-latest"]'
        required: false
      oci-registry:
        description: "OCI registry where to pull and push images."
        type: string
        default: "ghcr.io"
        required: false
      oci-registry-username:
        description: |
          Username used to log against the OCI registry.
          See https://github.com/docker/login-action#usage.
        type: string
        default: ${{ github.repository_owner }}
        required: false
      platforms:
        description: |
          JSON array of platforms to build images for.
          See https://docs.docker.com/buildx/working-with-buildx/#build-multi-platform-images.
        type: string
        default: '["linux/amd64","linux/arm64"]'
        required: false
      images:
        description: |
          JSON array of images to build.
          If not provided, all available images will be considered.
          Example: `["php-8", "nodejs-24"]`
        type: string
        required: false
    outputs:
      built-images:
        description: |
          Built images data.
          See https://github.com/hoverkraft-tech/ci-github-container/blob/main/.github/workflows/docker-build-images.md#outputs.
        value: ${{ jobs.build-images.outputs.built-images }}
    secrets:
      oci-registry-password:
        description: |
          Password or GitHub token (packages:read and packages:write scopes) used to log against the OCI registry.
          Defaults to GITHUB_TOKEN if not provided.
        required: false

permissions: {}

jobs:
  prepare-images-to-build:
    runs-on: ${{ fromJson(inputs.runs-on) }}
    permissions:
      contents: read
      id-token: write # Needed for getting local workflow actions
    outputs:
      images: ${{ steps.set-images-to-build.outputs.images }}
    steps:
      - id: local-workflow-actions
        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          actions-path: actions

      - id: get-available-images
        if: ${{ !inputs.images || inputs.images == '[]' }}
        uses: ./self-workflow/actions/get-available-images

      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        with:
          actions-path: actions
          repository: ${{ steps.local-workflow-actions.outputs.repository }}
          ref: ${{ steps.local-workflow-actions.outputs.ref }}

      - id: should-build-images
        if: ${{ !inputs.images || inputs.images == '[]' }}
        uses: ./self-workflow/actions/should-build-images
        with:
          images: ${{ steps.get-available-images.outputs.images }}

      - id: set-images-to-build
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          SHOULD_BUILD_IMAGES: ${{ steps.should-build-images.outputs.should-build-images }}
          IMAGES: ${{ inputs.images }}
          PLATFORMS: ${{ inputs.platforms }}
        with:
          script: |
            let images = [];

            if (process.env.IMAGES) {
              images = JSON.parse(process.env.IMAGES);
              if(!Array.isArray(images)) {
                throw new Error("Input 'images' is not a valid JSON array.");
              }
            } else if (process.env.SHOULD_BUILD_IMAGES){
              images = Object.entries(JSON.parse(process.env.SHOULD_BUILD_IMAGES))
                .filter(([image, shouldBuild]) => shouldBuild === true)
                .map(([image, shouldBuild]) => {
                  return {  name: image };
                });
            }

            if (images.length === 0) {
              core.info("No images to build.");
              return;
            }

            const platforms = JSON.parse(process.env.PLATFORMS);
            const imagesToBuild = [];
            for (const image of images) {
              if (typeof image !== 'object' || !image.name) {
                throw new Error("Image entry is not valid. It should be either a string or an object with a 'name' property.");
              }
              imagesToBuild.push({
                  context: `images/${image.name}`,
                  dockerfile: 'Dockerfile',
                  platforms,
                  ...image,
              });
            }
            core.setOutput('images', JSON.stringify(imagesToBuild));
      # jscpd:ignore-start
      - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@4b53189212d5810f710bed89711002626977215b # 0.33.0
        if: always() && steps.local-workflow-actions.outputs.repository
        with:
          actions-path: actions
          repository: ${{ steps.local-workflow-actions.outputs.repository }}
          ref: ${{ steps.local-workflow-actions.outputs.ref }}
      # jscpd:ignore-end

  build-images:
    needs: prepare-images-to-build
    if: needs.prepare-images-to-build.outputs.images
    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@bcbbcaff24e053e38ebab02dd0e41442df196719 # 0.32.0
    permissions:
      contents: read
      issues: read
      packages: write
      pull-requests: read
      id-token: write
    with:
      oci-registry-username: ${{ inputs.oci-registry-username }}
      oci-registry: ${{ inputs.oci-registry }}
      images: ${{ needs.prepare-images-to-build.outputs.images }}
    secrets:
      oci-registry-password: ${{ secrets.oci-registry-password || secrets.GITHUB_TOKEN || github.token }}

  summary:
    name: Built Images
    if: needs.build-images.outputs.built-images
    runs-on: ${{ fromJson(inputs.runs-on) }}
    needs: build-images
    permissions:
      contents: read
      pull-requests: write
    steps:
      - id: generate-summary
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          BUILT_IMAGES: ${{ needs.build-images.outputs.built-images }}
        with:
          script: |
            const builtImages = JSON.parse(process.env.BUILT_IMAGES || '{}');
            const imageNames = Object.keys(builtImages);

            if (imageNames.length === 0) {
              core.setOutput('summary', '');
              return;
            }

            const headers = ['Image', 'Tags', 'Platforms', 'Digest'];
            const tableRows = [];

            for (const imageName of imageNames) {
              const imageData = builtImages[imageName];
              const tags = imageData.tags ? imageData.tags.join(', ') : '-';
              const platforms = imageData.platforms ? imageData.platforms.join(', ') : '-';
              const digest = imageData.digest ? `${imageData.digest.substring(0, 20)}...` : '-';
              const fullImage = (imageData.registry && imageData.repository)
                ? `${imageData.registry}/${imageData.repository}`
                : imageName;

              tableRows.push([fullImage, tags, platforms, digest]);
            }

            await core.summary.clear();

            core.summary
              .addHeading('Built Images Summary', 2)
              .addTable([
                headers.map((header) => ({ data: header, header: true })),
                ...tableRows.map((row) => row.map((cell) => ({ data: cell }))),
              ])
              .addHeading('Image Details', 3);

            for (const imageName of imageNames) {
              const imageData = builtImages[imageName];
              let detailMarkup = '';
              if (imageData.images && imageData.images.length > 0) {
                const primaryImage = imageData.images[0];
                const pullCommand = `docker pull ${primaryImage}`;

                detailMarkup += '<p><strong>Pull command:</strong></p>\n';
                detailMarkup += '<pre><code>\n';
                detailMarkup += `${pullCommand}\n`;
                detailMarkup += '</code></pre>\n';

                detailMarkup += '<p><strong>Full image references:</strong></p>\n<ul>\n';
                for (const image of imageData.images) {
                  detailMarkup += `<li><code>${image}</code></li>\n`;
                }
                detailMarkup += '</ul>\n';
              }

              if (imageData.annotations) {
                const annotationsMarkup = Object.entries(imageData.annotations)
                  .map(([key, value]) => `<li><code>${key}</code>: ${value}</li>`)
                  .join('\n');

                detailMarkup += '<p><strong>Annotations:</strong></p>\n';
                detailMarkup += `<ul>\n${annotationsMarkup}\n</ul>`;
              }

              const detailsBody = detailMarkup || '<em>No additional details.</em>';
              core.summary.addDetails(imageName, detailsBody);
            }

            const summaryContent = await core.summary.stringify();
            await core.summary.write();
            core.setOutput('summary', summaryContent);

      - uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@4b53189212d5810f710bed89711002626977215b # 0.33.0
        if: github.event.pull_request.number && steps.generate-summary.outputs.summary
        with:
          title: "## Built Images Summary"
          body: ${{ steps.generate-summary.outputs.summary }}